Security Policy

1. How we protect information

• Encrypted connections: the Site is served only over HTTPS, with HTTP Strict Transport Security.
• Passwords: stored only as salted, iterated hashes, never in plain text. Temporary passwords must be changed at first sign-in.
• Sessions: sign-in cookies are HttpOnly, Secure and SameSite, and expire automatically.
• Forms: protected with CSRF tokens, rate limiting, bot checks (CAPTCHA) and spam traps.
• Stored data: customer records are encrypted at rest when encryption is configured on our servers, and sensitive files are never served publicly.
• Browser protections: a strict Content Security Policy, clickjacking protection and other security headers.
• Access: administrative tools are limited to authorized Alsaray staff.
• Payments: we do not collect or store card numbers on this website.

2. Keeping your account safe

• Use a long, unique password that you do not use anywhere else.
• Do not share your sign-in with other people; ask us for additional accounts instead.
• Sign out on shared computers.
• If you think someone else has used your account, change your password and call us at 248-856-5330.

3. Emails and phone calls from us

We will never ask for your password by email, text or phone. Password-reset links come only after you request one and expire within an hour. If you receive a suspicious message claiming to be from Alsaray, do not click its links; call us at 248-856-5330 to check.

4. Reporting a vulnerability

If you believe you have found a security vulnerability in this Site, please tell us. Email info@alsaraywholesale.com with the subject "Security report" and include:

• the page or feature affected and a description of the issue;
• steps to reproduce it; and
• how we can contact you.

We review the reports we receive and may contact you if we need more information. Please give us reasonable time to fix the issue before sharing it publicly. Our contact details are also published at /.well-known/security.txt.

5. Scope and rules

When investigating, please:

• only test against your own account, and never access, change or delete other people's data;
• stop and report as soon as you find a problem that exposes data;
• not run denial-of-service attacks, spam, social engineering or physical attacks; and
• not use automated scanners that send large volumes of requests.

This policy does not authorize testing of third-party services we use, and it does not waive any of our rights.

6. If something goes wrong

If a security incident affects your personal information, we will notify you and the authorities as required by law, including Michigan's data breach notification law.